July 15, 2015 By Douglas Bonderud 3 min read

What’s in a name? When it comes to cybercriminal groups, their stated names — or the ones given to them by security researchers — often help set attacks in context or give some clue as to their methodology. Not so with Butterfly, recently changed from the moniker Morpho and previously known as Wild Neutron. Here, moniker and malice aren’t related but come with real risk: According to FierceITSecurity, the group has been active since 2013 and targets the intellectual property (IP) of private firms.

Big names like Apple, Facebook and Twitter were all compromised, along with legal and pharmaceutical firms. Now, commodity companies such as oil and gas producers are under threat from Butterfly/Morpho/Wild Neutron. How can businesses protect their intellectual assets?

Morpho Goes Name-Dropping

According to eWEEK, the Wild Neutron group was first identified and named by Kaspersky Lab in 2011, and it went after high-profile corporate IP in 2013. Last month, security firm Symantec detected the group at work again, this time targeting Fortune 200 commodity companies. They called the collective Morpho, which sounds at least somewhat ominous. But as noted by IT News, they were quickly informed by security and identity solutions firm Morpho that the name was already taken and has nothing to do with stealing IP, so Symantec quickly changed the tag to Butterfly.

The connection isn’t obvious, but the morpho is actually a type of Central American butterfly, helping to maintain at least some sense of continuity; unfortunately, any sense of urgency or threat was likely lost because the winged insects aren’t exactly high-profile predators.

A Well-Funded Group

Despite the name, Butterfly poses a serious threat to private corporations. According to CSO Online, the group is well-funded and uses fake certificates combined with watering-hole websites familiar to corporate users as a launch pad for its malware payload. Often, infection follows a new product launch or press release, when it’s most likely that a company will release research papers or have other critical documents on hand.

After getting in and grabbing the information needed, Butterfly deployments clean up the mess by deleting, rewriting and then redeleting critical malware files multiple times, making it nearly impossible to recreate the original code. In some cases, the group even paid for its own servers rather than hacking what’s available, but it paid for the hardware in small bitcoin transfers to avoid detection.

Vikram Thakur, senior manager at Symantec, believed that the Butterfly attacks are financially and not politically motivated, noting to CSO Online that the attackers are extremely careful with the information they obtain. So far, there’s no evidence of any high-profile IP for sale on the Dark Web, and while the data could be used for insider trading, there has been no odd stock market movement after the thefts occur. Vice president of security firm Fasoo, Ron Arden, said it’s possible that the group also employs insiders who are willing to deliberately compromise their accounts and give malicious actors access to five-year plans or financial statements.

Staying Butterfly-Free

Is it possible for companies to detect and defeat Butterfly attacks on their systems? Marta Janus of Kaspersky Lab told eWEEK that the group often uses Adobe Flash Player, so it’s a good idea to regularly update Flash and all third-party applications. Regular PC scanning and avoiding hacked forums are also on the list of preventative measures, but it’s a smart move to take proactive steps.

For example, if a company has just released new findings or described the arc of a new product launch to the media, it’s a safe bet that Butterfly attackers are listening in and poking around network edges for potential holes. It’s worthwhile to spend extra time monitoring and evaluating network behavior and reaffirming online best practices to prevent accidental infections.

Morpho/Wild Neutron/Butterfly can’t keep the same name, but the risk factor hasn’t changed: Affected companies could lose massive amounts of IP. Tread carefully — this butterfly is no lightweight.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today